How we guard your funds
We assume the bot server gets hacked one day, and that must not hand anyone your keys or money.
- Isolated keys
- Private keys are envelope-encrypted and used only inside a separate signing service. The bot server cannot read or export them.
- Independent signing policy
- The signer checks every operation itself: swaps pay only to your wallet, daily turnover is capped, order prices stay within 10 points of the market.
- 24-hour delay
- A new withdrawal address, a key export or higher limits kick in 24 hours after the security service notifies you.
- Circuit breaker
- An unusual burst of signatures across different wallets halts the signer until a human checks it.
- Emergency freeze
- The /freeze command or the button in your account blocks withdrawals, signatures and sessions instantly.
- AI without powers
- AI only explains market rules and cannot send an order or a withdrawal. Market texts are treated as untrusted data.
- PIN and 2FA on withdrawals
- Every withdrawal, new withdrawal address and key export needs your PIN, plus a code from an authenticator app if you turn on 2FA. Five wrong PINs lock withdrawals for an hour.